Try our new research platform with insights from 80,000+ expert users
Splunk Enterprise Security Logo

Splunk Enterprise Security pros and cons

Vendor: Splunk
4.2 out of 5
Badge Ranked 1
9,770 followers
Post review

Pros & Cons summary

Buyer's Guide

Get pricing advice, tips, use cases and valuable features from real users of this product.
Get the report

Prominent pros & cons

PROS

Splunk Enterprise Security is valued for its comprehensive and intuitive dashboarding capabilities, enhancing cybersecurity visualizations and monitoring.
Users appreciate the scalability and ability to process vast amounts of data efficiently, assisting in complex environments.
It offers robust log management and aggregation features, crucial for detailed data analysis and operational insights.
Splunk Enterprise Security is recognized for its flexibility and integration ease with various devices and platforms, supporting a wide range of use cases.
The platform's capacity for fast and efficient data search and retrieval significantly aids in threat detection and analysis.

CONS

Splunk Enterprise Security is difficult to set up initially and has a high learning curve for users.
The billing and licensing model of Splunk Enterprise Security is complex and can be costly.
Splunk Enterprise Security lacks built-in alerting features available in competing products like Datadog and PagerDuty.
The search functionality in Splunk Enterprise Security is query-based and can be difficult to use and customize.
Splunk Enterprise Security's integration with third-party services and data sources can be improved.
 

Splunk Enterprise Security Pros review quotes

Rishabh Gandhi - PeerSpot reviewer
Sep 6, 2023
Our clients use the solution to find any threats or vulnerabilities inside their environment.
SC
Aug 11, 2023
The most valuable features include agility and Splunk Enterprise Security's ability to quickly search for alerted items, as well as the capacity to create custom alerts using the SQL language employed by Splunk.
LC
Dec 22, 2021
The feature that I have found most valuable with Splunk is the ability to sift through a bunch of data very quickly.
Learn what your peers think about Splunk Enterprise Security. Get advice and tips from experienced pros sharing their opinions. Updated: October 2024.
814,763 professionals have used our research since 2012.
PP
Nov 13, 2023
The best part of Splunk Enterprise Security is its customizable settings.
AC
Jun 13, 2024
It is lovely to have everything we need in one tool. Everything is quite centralized.
AJ
Mar 22, 2024
Splunk Enterprise Security allows us to create custom dashboards by changing fonts and modifying widgets.
PW
May 11, 2023
The varied prebuilt feature is the most valuable because it ensures that we have complete coverage over all of the key questions.
AK
Jun 12, 2024
The most valuable feature of Splunk Enterprise Security is the threat intelligence integration because essentially having to go out and correlate all the data on our own becomes convoluted.
Daniel Hammons - PeerSpot reviewer
Jun 13, 2024
The incident review pane is the best part of it because that is where the SOC lives. It is the heartbeat of what the SOC needs to do. You are able to start the investigative process. As you are sitting in the incident review pane, you see the alert, and from that one alert, which is called a notable alert, you can drill in and see all the different specific details that are tied to that.
Valarie - PeerSpot reviewer
Jun 12, 2024
Being able to aggregate detection and alerts from various sources is valuable. Like everyone else, we have a wide range of tools in our shop. We are able to stop at one spot and look at all the data. All the data is able to come through, and we can then jump from source to source or index to index. We can dig deep whenever we need to and get a good high-level understanding.
 

Splunk Enterprise Security Cons review quotes

Rishabh Gandhi - PeerSpot reviewer
Sep 6, 2023
It would be great if I could have a certain dialogue box in Splunk that uses innovative AI tools like ChatGPT, which are available now in the tech department.
SC
Aug 11, 2023
Splunk could enhance its services by providing more comprehensive professional assistance aimed at optimizing our investment.
LC
Dec 22, 2021
Their technical support sucks.
Learn what your peers think about Splunk Enterprise Security. Get advice and tips from experienced pros sharing their opinions. Updated: October 2024.
814,763 professionals have used our research since 2012.
PP
Nov 13, 2023
Splunk Enterprise Security has not helped reduce our alert volume.
AC
Jun 13, 2024
Splunk Enterprise Security provides us with the relevant context to help guide our investigations, but it would be interesting to add even more context, for instance, in order to raise the level of risk.
AJ
Mar 22, 2024
I've noticed that onboarding data from various multi-cloud sources and diverse products, such as security network devices, can be challenging.
PW
May 11, 2023
It is important to make sure that everything is built off of the threat models and all the underlying items within Splunk.
AK
Jun 12, 2024
For us, the area that Splunk Enterprise Security can improve is performance optimization.
Daniel Hammons - PeerSpot reviewer
Jun 13, 2024
Being able to have a one-stop shop where you have the alert, but then you can generate the case right there from Splunk Enterprise Security instead of having to pivot to another tool such as Mission Control. You do not have to keep bouncing between them, so if you could do it all in one place, that would be great. The new release is supposed to start getting in that direction.
Valarie - PeerSpot reviewer
Jun 12, 2024
The first thing that comes to mind is a little bit of UI improvement. It sometimes can be a little bit buggy or it can be a little bit slow, but that varies from customer to customer.